CVE-2021-21342: XStream unmarshalling deserialization enables server-side request forgery

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCritical CVSS (9.1) with network, unauthenticated, no-interaction exploitation and a high EPSS percentile, though it is not in KEV and requires a reachable unmarshalling endpoint.

What it is

XStream before 1.4.16 recreates objects from type information embedded in the XML stream during unmarshalling, so an attacker who controls that stream can replace or inject objects. This leads to server-side request forgery and, per the CWE mapping, untrusted-data deserialization. Deployments relying on XStream's default blacklist are exposed; those using a minimal whitelist are not affected.

Impact

An attacker can force the application to issue server-side requests and manipulate deserialized object state, with high confidentiality and integrity impact per the CVSS vector. No availability impact is scored.

Attack surface

Reached over the network by submitting a crafted XML stream to an endpoint that unmarshals with XStream. The vector shows no privileges and no user interaction required, so any reachable unmarshalling entry point is a candidate.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is 0.4999 (98.8th percentile) and the vendor advisory reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade XStream to 1.4.16 or later, which is the fixed release named in the advisory.
• If upgrade is not immediate, configure XStream's security framework with a whitelist limited to the minimal required types rather than relying on the default blacklist.
• Apply vendor patches for the listed downstream products (NetApp, Oracle, Debian, Fedora, Apache ActiveMQ and JMeter) that bundle XStream.
• Identify and restrict network egress from any service that unmarshals XStream XML, so SSRF targets are not reachable.
• Review all endpoints accepting XML for XStream unmarshalling and disable it where not required.

Detection

• Search application and proxy logs for XML request bodies containing XStream type metadata or unexpected class names in unmarshalling endpoints.
• Monitor outbound connections from application servers to internal or unusual destinations for SSRF patterns.
• Inventory deployed XStream versions across applications and bundled products to find anything below 1.4.16.
• Alert on deserialization exceptions or class-loading errors from XStream that cluster around a single client or endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.